Can the FireEye app collect pcap information in Splunk from an alert that occurs in FireEye?

[Yediyd]

Can the FireEye Splunk App provide the pcap information from an alert that occurs in FireEye? The alerts I'm looking at are the ones from Web MPS in the Communication Capture field where you can "Get pcap file". If there is a way to have that pcap available in Splunk or a way to easily pivot to the pcap from Splunk that would be excellent.

[TonyLeeVT · Accepted solution]

The PCAP does not transfer to Splunk, however there is an event field link within the analysis dashboards that will take you to that event and allow you to download the PCAP. This works even if the pivot is to a CM appliance because the CM appliance will pull the PCAP from the LMS appliance and still make it available.

From the Splunk app, navigate to the LMS analysis page. For example NX Analysis.

• Click the event in question
• A details panel should appear below the events
• The far right link will be an event link that will pivot you back to the appliance to see that event
• Click that and authenticate if necessary and you can download the PCAP there

Hope that helps.